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Abstract 

There  has  been  a  great  deal  of  work  on  characterizing  the  complexity  of  the  satisfi¬ 
ability  and  validity  problem  for  modal  logics.  In  particular,  Ladner  showed  that  the  sat¬ 
isfiability  problem  for  all  logics  between  K  and  S4  is  PS  PACE- hard,  while  for  S5  it  is 
NP-complete.  We  show  that  it  is  negative  introspection,  the  axiom  -i Kp  =v  K->Kp,  that 
causes  the  gap:  if  we  add  this  axiom  to  any  modal  logic  between  K  and  S4,  then  the  satis¬ 
fiability  problem  becomes  NP-complete.  Indeed,  the  satisfiability  problem  is  /YP-complctc 
for  any  modal  logic  that  includes  the  negative  introspection  axiom. 
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1  Introduction 

There  has  been  a  great  deal  of  work  on  characterizing  the  complexity  of  the  satisfiability  and 
validity  problem  for  modal  logics  (see  [7;  9;  14;  15]  for  some  examples).  In  particular,  Ladner 
[9]  showed  that  the  validity  (and  satisfiability)  problem  for  every  modal  logic  between  K  and 
S4  is  PSPACE- hard;  and  is  PSPACE-complete  for  the  modal  logics  K,  T,  and  S4.  He  also 
showed  that  the  satisfiability  problem  for  S5  is  NP-complete. 

What  causes  the  gap  between  NP  and  PSPACE  here?  We  show  that,  in  a  precise  sense,  it 
is  the  negative  introspection  axiom:  ->Kp  =>■  K-iKp.  It  easily  follows  from  Ladner’s  proof 
of  PSPACE-hardness  that  for  any  modal  logic  L  between  K  and  S4,  there  exists  a  family  of 
formulas  pn,  all  consistent  with  L  such  that  such  that  \pn\  =  0(n )  but  the  smallest  Kripke 
structure  satisfying  p  has  at  least  2n  states  (where  \p\  is  the  length  of  p  viewed  as  a  string 
of  symbols).  By  way  of  contrast,  we  show  that  for  all  of  the  (infinitely  many)  modal  logics  L 
containing  K5  (that  is,  every  modal  logic  containing  the  axiom  K — KpAK (p  =>•  ip)  =4-  Kip — 
and  the  negative  introspection  axiom,  which  has  traditionally  been  called  axiom  5),  if  a  formula 
p  is  consistent  with  L,  then  it  is  satisfiable  in  a  Kripke  structure  of  size  linear  in  \p\.  Using  this 
result  and  a  characterization  of  the  set  of  finite  structures  consistent  with  a  logic  L  containing 
K5  due  to  Nagle  and  Thomason  [12],  we  can  show  that  the  consistency  (i.e.,  satisfiability) 
problem  for  L  is  NP-complete.  Thus,  roughly  speaking,  adding  negative  introspection  to  any 
logic  between  K  and  S4  lowers  the  complexity  from  PSPACE- hard  to  NP-complete. 

The  fact  that  the  consistency  problem  for  specific  modal  logics  containing  K5  is  NP- 
complete  has  been  observed  before.  As  we  said,  Ladner  already  proved  it  for  S5;  an  easy 
modification  (see  [6])  gives  the  result  for  KD45  and  K45.1  That  the  negative  introspection 
axiom  plays  a  significant  role  has  also  been  observed  before;  indeed,  Nagle  [11]  shows  that 
every  formula  p  consistent  with  a  normal  modal  logic2  L  containing  K5  has  a  finite  model  (in¬ 
deed,  a  model  exponential  in  |</?|)  and  using  that,  shows  that  the  provability  problem  for  every 
logic  L  between  K  and  S5  is  decidable;  Nagle  and  Thomason  [12]  extend  Nagle’s  result  to  all 
logics  containing  K5  not  just  normal  logics.  Despite  all  this  prior  work  and  the  fact  that  our 
result  follows  from  a  relatively  straightforward  combination  of  results  of  Nagle  and  Thomason 
and  Ladner’s  techniques  for  proving  that  the  consistency  problem  for  S5  is  NP-complete,  our 
result  seems  to  be  new,  and  is  somewhat  surprising  (at  least  to  us!). 

The  rest  of  the  paper  is  organized  as  follows.  In  the  next  section,  we  review  standard  notions 
from  modal  logic  and  the  key  results  of  Nagle  and  Thomason  [12]  that  we  use.  In  Section  3, 
we  prove  the  main  result  of  the  paper.  We  discuss  related  work  in  Section  4. 

2  Modal  Logic:  A  Brief  Review 

We  briefly  review  basic  modal  logic,  introducing  the  notation  used  in  the  statement  and  proof 
of  our  result.  The  syntax  of  the  modal  logic  is  as  follows:  formulas  are  formed  by  starting  with 

1Nguyen  [13]  also  claims  the  result  for  K5,  referencing  Ladner.  While  the  result  is  certainly  true  for  K5,  it  is 
not  immediate  from  Ladner’s  argument. 

2A  modal  logic  is  normal  if  it  satisfies  the  generalization  rule  RN:  from  p  infer  Kp. 
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a  set  $  =  {p,q,...}  of  primitive  propositions,  and  then  closing  off  under  conjunction  (A), 
negation  (->),  and  the  modal  operator  K.  Call  the  resulting  language  (<f>).  (We  often  omit 
the  <f>  if  it  is  clear  from  context  or  does  not  play  a  significant  role.)  As  usual,  we  define  ipVip  and 
ip  ip  as  abbreviations  of  A  -up)  and  -> ip  V  ip,  respectively.  The  intended  interpretation 
of  Kip  varies  depending  on  the  context.  It  typically  has  been  interpreted  as  knowledge,  as 
belief,  or  as  necessity.  Under  the  epistemic  interpretation,  Kip  is  read  as  “the  agent  knows  ip 
under  the  necessity  interpretation,  Kip  can  be  read  uip  is  necessarily  true”. 

The  standard  approach  to  giving  semantics  to  formulas  in  £f  (<h)  is  by  means  of  Kripke 
structures.  A  tuple  F  =  (S,  1C)  is  a  (Kripke)  frame  if  S'  is  a  set  of  states  and  1C  is  a  binary 
relation  on  S.  A  situation  is  a  pair  (F,  s),  where  F  =  (S',  K)  is  a  frame  and  s  G  S'.  A 
tuple  M  =  (S',  /C,  7r)  is  a  Kripke  structure  (over  if  (S',  /C)  is  a  frame  and  n  :  S'  x  — > 
{true,  false}  is  an  interpretation  (on  S)  that  determines  which  primitive  propositions  are  true 
at  each  state.  Intuitively,  (s,  t)  E  1C  if,  in  state  s,  state  t  is  considered  possible  (by  the  agent, 
if  we  are  thinking  of  K  as  representing  an  agent’s  knowledge  or  belief).  For  convenience,  we 
define  JC(s)  =  {t  :  (. s,t )  E  1C}. 

Depending  on  the  desired  interpretation  of  the  formula  Kip,  a  number  of  conditions  may 
be  imposed  on  the  binary  relation  1C.  1C  is  reflexive  if  for  all  s  E  S',  (s,  s)  E  /C;  it  is  transitive 
if  for  all  s,t,u  E  S',  if  (s,  t)  E  1C  and  (£,  u)  E  1C,  then  (s,  u)  E  /C;  it  is  serial  if  for  all  s  E  S 
there  exists  t  E  S  such  that  (s,t)  E  /C;  it  is  Euclidean  iff  for  all  s,t,u  E  S',  if  (s,t)  E  1C 
and  (s,u)  E  1C  then  (t,  u)  E  1C.  We  use  the  superscripts  r,  e,  t  and  s  to  indicate  that  the  1C 
relation  is  restricted  to  being  reflexive,  Euclidean,  transitive,  and  serial,  respectively.  Thus,  for 
example,  Srt  is  the  class  of  all  situations  where  the  1C  relation  is  reflexive  and  transitive. 

We  write  ( M,s )  f=  ip  if  ip  is  true  at  state  s  in  the  Kripke  structure  M.  The  truth  relation  is 
defined  inductively  as  follows: 

(M,  s)  |=  p,  for  p  E  <f>,  if  7T (s,p)  =  true 
(M,  s)  |=  ->ip  if  (M,  s)  ip 
(. M ,  s)  |=  ip  A  if  (M,  s)  \=  ip  and  (M,  s)  |=  ip 
(M,  s)  |=  Kip  if  (M,  t)  \=  p  for  all  t  E  )C(s) 

A  formula  ip  is  said  to  be  satisfiable  in  Kripke  structure  M  if  there  exists  s  E  S  such  that 
(M,  s)  | =  ip;  ip  is  said  to  be  valid  in  M,  written  M  |=  ip,  if  (M,  s)  |=  p  for  all  s  E  S.  A  formula 
is  satisfiable  (resp.,  valid )  in  a  class  A f  of  Kripke  structures  if  it  is  satisfiable  in  some  Kripke 
structure  in  J\f  (resp.,  valid  in  all  Kripke  structures  in  J\f).  There  are  analogous  definitions  for 
situations.  A  Kripke  structure  M  =  ( S ,  1C,  n)  is  based  on  a  frame  F  =  (S',  1C)  if  S'  —  S  and 
1C  =  1C.  The  formula  ip  is  valid  in  situation  (F.  s ),  written  (F.  s )  |=  ip,  where  F  =  (S,  1C)  and 
s  E  S,  if  (M,  s)  |=  ip  for  all  Kripke  structure  M  based  on  F. 

Modal  logics  are  typically  characterized  by  axiom  systems.  Consider  the  following  axioms 
and  inference  rules,  all  of  which  have  been  well-studied  in  the  literature  [3;  4;  6].  (We  use 
the  traditional  names  for  the  axioms  and  rules  of  inference  here.)  These  are  actually  axiom 
schemes  and  inference  schemes',  we  consider  all  instances  of  these  schemes. 
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Prop.  All  tautologies  of  propositional  calculus 

K.  {Kip  A  K{ip  =>•  ip))  =>•  Kip  (Distribution  Axiom) 

T.  Kp  =>  p  (Knowledge  Axiom) 

4.  Kip  KKip  (Positive  Introspection  Axiom) 

5.  -i Kip  =>  K-^Kip  (Negative  Introspection  Axiom) 

D.  ->K (false)  (Consistency  Axiom) 

MP  From  ip  and  p  =>•  ip  infer  ip  (Modus  Ponens) 

RN.  From  ip  infer  Kip  (Knowledge  Generalization) 

The  standard  modal  logics  are  characterized  by  some  subset  of  the  axioms  above.  All  are 
taken  to  include  Prop,  MP,  and  RN;  they  are  then  named  by  the  other  axioms.  For  example,  K5 
consists  of  all  the  formulas  that  are  provable  using  Prop,  K,  5,  MP,  and  RN;  we  can  similarly 
define  other  systems  such  as  KD45  or  KT5.  KT  has  traditionally  been  called  T;  KT4  has 
traditionally  been  called  S4;  and  KT45  has  traditionally  been  called  S5. 

For  the  purposes  of  this  paper,  we  take  a  modal  logic  L  to  be  any  collection  of  formulas 
that  contains  all  instances  of  Prop  and  is  closed  under  modus  ponens  (MP)  and  substitution,  so 
that  if  ip  is  a  formula  in  L  and  p  is  a  primitive  proposition,  then  ip\p/ip\  e  L,  where  ip\p/ip\  is 
the  result  of  replacing  all  instances  of  p  in  ip  by  ip.  A  logic  is  normal  if  it  contains  all  instances 
of  the  axiom  K  and  is  closed  under  the  inference  rule  RN.  In  terms  of  this  notation,  Ladner 
[9]  showed  that  if  L  is  a  normal  modal  logic  between  K  and  S4  (since  we  are  identifying  a 
modal  logic  with  a  set  of  formulas  here,  that  just  means  that  KCfC  S4),  then  determining 
if  ip  e  L  is  PSPACE-hard.  (Of  course,  if  we  think  of  a  modal  logic  as  being  characterized 
by  an  axiom  system,  then  ip  e  L  iff  p  is  provable  from  the  axioms  characterizing  L .)  We 
say  that  ip  is  consistent  with  L  if  -> p  f  L.  Since  consistency  is  just  the  dual  of  provability,  it 
follows  from  Ladner’s  result  that  testing  consistency  is  PSPACE-hard  for  every  normal  logic 
between  K  and  S4.  Ladner’s  proof  actually  shows  more:  the  proof  holds  without  change  for 
non-normal  logics,  and  it  shows  that  some  formulas  consistent  with  logics  between  K  and  S4 
are  satisfiable  only  in  large  models.  More  precisely,  it  shows  the  following: 

Theorem  2.1:  [9] 

(a)  Checking  consistency  is  PSPACE  complete  for  every  logic  between  K  and  S4  (even  non¬ 
normal  logics ). 

(b)  For  every  logic  L  between  K  and  S4,  there  exists  a  family  of  formulas  pTn,  n  =  1,  2,  3, . . ., 
such  that  (i)  for  all  n,  pp  is  consistent  with  L,  (ii)  there  exists  a  constant  d  such  that 
\Pn\  —  d‘n’  ( M smallest  Kripke  structure  that  satisfies  p  has  at  least  2”  states. 
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There  is  a  well-known  correspondence  between  properties  of  the  /C  relation  and  axioms: 
reflexivity  corresponds  to  T,  transitivity  corresponds  to  4,  the  Euclidean  property  corresponds 
to  5,  and  the  serial  property  corresponds  to  D.  This  correspondence  is  made  precise  in  the 
following  well-known  theorem  (see,  for  example,  [6]). 

Theorem  2.2:  Lei  C  be  a  (possibly  empty )  subset  of  {T,  4,  5,  l)  \  and  letC  be  the  corresponding 
subset  of  {r,  t,  e,  s}.  Then  {Prop,  K,  MP,  RN}  U  C  is  a  sound  and  complete  axiomatization  of 
the  language  Cf  (<f>)  with  respect  to  lSc($).3 

Given  a  modal  logic  L,  let  SL  consist  of  all  situations  (F,  s )  such  that  v  e  L  implies  that 
(F,  s )  |=  p.  An  immediate  consequence  of  Theorem  2.2  is  that  Se,  the  situations  where  the  /C 
relation  is  Euclidean,  is  a  subset  of  <SK5. 

Nagle  and  Thomason  [12]  provide  a  useful  semantic  characterization  of  all  logics  that  con¬ 
tain  K5.  We  review  the  relevant  details  here.  Consider  all  the  finite  situations  ((S,  /C),  s)  such 
that  either 

1.  S  is  the  disjoint  union  of  Si,  S2,  and  {s}  and  /C  =  ({s}  x  Si)  U  ((Si  U  S2)  x  (Si  U  S2)), 
where  S2  =  0  if  Si  =  0;  or 

2.  IC  =  S  xS. 

Using  (a  slight  variant  of)  Nagle  and  Thomason’s  notation,  let  with  m  >  1  and  n  >  0 
or  (■ m,n )  =  (0,0),  denote  all  situations  of  the  first  type  where  ,5j  =  m  and  \S2\  =  n,  and 
let  Sm- 1  denote  all  situations  of  the  second  type  where  \S\  =  m.  (The  reason  for  taking  -1 
to  be  the  second  subscript  for  situations  of  the  second  type  will  become  clearer  below.)  It  is 
immediate  that  all  situations  in  <Smjn  for  fixed  m  and  n  are  isomorphic — they  differ  only  in 
the  names  assigned  to  states.  Thus,  the  same  formulas  are  valid  in  any  two  situations  in  Sm,n. 
Moreover,  it  is  easy  to  check  that  the  /C  relation  in  each  of  the  situations  above  in  Euclidean,  so 
each  of  these  situations  is  in  5K5.  It  is  well  known  that  the  situations  in  are  all  in  5K5 
and  the  situations  in  Sm- 1  U  Sm;0  are  all  in  ^k045.  in  fact,  S5  (resp.,  KD45)  is  sound  and 
complete  with  respect  to  the  situations  in  <STO;_i  (resp.,  Sm_ i  U  Smt0).  Nagle  and  Thomason 
show  that  much  more  is  true.  Let  TL  =  (U{Sm>n  :  m  >  1,  n  >  —  1  or  (m,  n)  =  (0,  0)})  fl  SL . 

Theorem  2.3:  [12]  For  every  logic  L  containing  K5,  L  is  sound  and  complete  with  respect  to 
the  situations  in  TL. 

The  key  result  of  this  paper  shows  that  if  a  formula  p  is  consistent  with  a  logic  L  containing 
K5,  then  there  exists  m,  n,  a  Kripke  structure  M  =  (S,JC,  n),  and  a  state  s  G  S  such  that 

3 We  remark  that  soundness  and  completeness  is  usually  stated  with  respect  to  the  appropriate  class  Mc  of 
structures,  rather  than  the  class  Sc  of  situations.  However,  the  same  proof  applies  without  change  to  show 
completeness  with  respect  to  Sc .  and  using  SG  allows  us  to  relate  this  result  to  our  later  results.  While  for  normal 
logics  it  suffices  to  consider  only  validity  with  respect  to  structures,  for  non-normal  logics,  we  need  to  consider 
validity  with  respect  to  situations. 
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{{S, /C),s)  E  Smn,  Sm)n  C  TL,  and  m  +  n  <  \ip\.  That  is,  if  ip  is  satisfiable  at  all,  it  is 
satisfiable  in  a  situation  with  a  number  of  states  that  is  linear  in  \ip\. 

One  more  observation  made  by  Nagle  and  Thomason  will  be  important  in  the  sequel. 

Definition  2.4:  A  p-morphism  (short  for  pseudo -epimorphism)  from  situation  {{S' ,  1C),  s')  to 
situation  (( S ,  1C),  s)  is  a  function  /  :  S'  — »  S  such  that 

•  f(s')  =  s; 

•  if  (si,  s2)  E  1C,  then  (f(si),  f{s2 ))  E  1C; 

•  if  (/(s i),  S3)  E  1C,  then  there  exists  some  s2  E  S'  such  that  (si,  s2)  E  K!  and  f{s2)  =  s3. 
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This  notion  of  p-morphism  of  situations  is  a  variant  of  standard  notions  of  p-morphism  of 
frames  and  structures  [3].  It  is  well  known  that  if  there  is  a  p-morphism  from  one  structure 
to  another,  then  the  two  structures  satisfy  the  same  formulas.  An  analogous  result  holds  for 
situations. 

Theorem  2.5:  If  there  is  a  p-morphism  from  situation  (F' ,  s')  to  (F,  s),  then  for  every  modal 
logic  L,  if{F',  s')  E  SL  then  (F,  s)  E  SL. 

Proof:  Suppose  that  F  =  (S,  1C),  F'  =  {S',  1C),  f  is  a  p-morphism  from  (F',  s')  to  (F,  s),  and 
{F',  s')  E  SL .  We  want  to  show  that  {F,  s)  E  SL.  Let  be  the  set  of  primitive  propositions. 
Given  an  interpretation  n  on  S,  define  an  interpretation  n'  :  S'  x  <3>  — >  (true,  false}  on  S' 
by  taking  tr'(t,p)  =  tr (f(t),p)  for  all  t  E  S'  and  p  E  $.  We  now  show  by  induction  on  the 
structure  of  formulas  that  for  all  states  t  E  S'  and  all  formulas  ip,  we  have  (F',  it',  t)  |=  ip  iff 
(F,  it,  /(f))  |=  p.  This  is  a  standard  argument  [3];  we  repeat  it  here  for  completeness. 

The  base  case  follows  immediately  from  the  definition  of  rd .  For  conjunctions  and  nega¬ 
tions  the  argument  is  immediate  from  the  induction  hypothesis.  Finally,  if  p  is  of  the  form  Kip' , 
first  suppose  that  (F',n',t)  f=  Kip'.  We  want  to  show  that  ( F,n,f(t ))  |=  Kip'.  So  suppose 
that  ( f(t),u )  E  1C.  Since  /  is  a  p-morphism,  then  there  exists  v!  E  S'  such  that  {t,u')  E  1C 
and  f(u')  =  u.  Since  {F',n',t)  |=  Kip',  it  must  be  the  case  that  {F',n',u')  \=  ip'.  By  the 
induction  hypothesis,  it  follows  that  (F,  7 r,  u)  \—  ip'.  Since  this  argument  applies  to  all  u  such 
that  ( f(t),u )  E  1C,  it  follows  that  (F,  it,  /(f))  |=  K,p' .  For  the  opposite  implication,  suppose 
that  (F,  7T,  /(f))  |=  Kip'.  We  want  to  show  that  {F' ,  n' ,  t)  (=  Kip' .  If  (f,  u)  E  1C  then,  since  /  is 
a  p-morphism,  (/(f),  /(«))  e  Since  {F,  n,  /(f))  |=  Kip',  it  follows  that  (F,  it,  f{u))  (=  ip' . 
By  the  induction  hypothesis,  (F1,  it',  u)  |=  ip' .  It  follows  that  {F' ,  it' ,  t)  [=  Kip' . 

To  complete  the  argument,  suppose  by  way  of  contradiction  that  ip  E  L  and  (F,  s)  \f  ip. 
Then  there  exists  an  interpretation  it  such  that  (F,  it,  s)  |=  -up.  Since  f(s')  =  s,  by  the  argu¬ 
ment  above,  there  exists  an  interpretation  ir'  on  S'  such  that  (F' .  ir' ,  s')  |=  -up,  contradicting 
the  assumption  that  (F1,  s')  E  SL.  I 
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Now  consider  a  partial  order  on  pairs  of  numbers,  so  that  (m,  n)  <  ( rri' .  n ')  iff  m  <  m! 
and  n  <  n' .  Nagle  and  Thomason  observed  that  if  (F.  s)  E  Srn/n,  (F' ,  s')  E  Srnpn>,  and 
(1,  —1)  <  (m,  n)  <  (m',  n'),  then  there  is  an  obvious  p-morphism  from  (F',  s')  to  (F,  s ):  if 
F  =  (S,  1C),  S  =  S i  U  S2,  F'  =  (S',  1C),  S'  =  S[  U  S!2  (where  St  and  S)  for  i  =  1,2  are 
as  in  the  definition  of  S„hn),  then  define  /  :  S'  — >  S  so  that  /(s')  —  s,  f  maps  S')  onto  S'!, 
and,  if  S2  f  0-  then  /  maps  S')  onto  S'2;  otherwise,  /  maps  S')  to  Si  arbitrarily.  The  following 
result  (which  motivates  the  subscript  —1  in  S>m  _i)  is  immediate  from  this  observation  and 
Theorem  2.5. 

Theorem  2.6:  If(F,s)  E  Sm,n,  ( F',s ')  E  Sm>y,  and  (1,-1)  <  (m,n)  <  (m',n'),  then  for 
every  modal  logic  L,  if(F',  s')  E  TL  then  (F,  s)  E  TL. 

3  The  Main  Results 

We  can  now  state  our  key  technical  result. 

Theorem  3.1:  If  L  is  a  modal  logic  containing  K5  and  -> p  f  L,  then  there  exist  m,  n  such 
that  m  +  n  <  \ip\,  a  situation  ( F,s )  E  SL  fl  Sm  n,  and  structure  M  based  on  F  such  that 
(M,  s)  h  F 

Proof:  By  Theorem  2.3,  if  -i ip  f  L,  there  is  a  situation  (F',  s0)  £  CL  such  that  (F',  sq)  If  -><p. 
Thus,  there  exists  a  Kripke  structure  M'  based  on  F'  such  that  (M' ,  so)  \=  <p ■  Suppose  that 
F'  E  Srni.n:.  If  m'  +  n1  <  \tp\,  we  are  done,  so  suppose  that  in'  +  n'  >  \<p\.  Note  that  this  means 
m!  >  1.  We  now  construct  a  a  situation  (F,  s)  E  Srn  n  such  that  (1,  —1)  <  (m,  n)  <  (m! ,  n'), 
m  +  n  <  \ip\,  and  (M,  s)  |=  ip  for  some  Kripke  structure  based  on  F.  This  gives  the  desired 
result.  The  construction  of  M  is  similar  in  spirit  to  Ladner’s  [9]  proof  of  the  analogous  result 
for  the  case  of  S5. 

Let  C'i  be  the  set  of  subformulas  of  (p  of  the  form  Kf  such  that  (M' ,  s0)  \=  -> Kip,  and  let 
C-2  be  the  set  of  subformulas  of  p  of  the  form  Kf>  such  that  KKf  is  a  subformula  of  p  and 
(M' ,  so)  |=  -i KKf  A  Kip.  (We  remark  that  it  is  not  hard  to  show  that  if  /C  is  either  reflexive 
or  transitive,  then  C2  =  0.) 

Suppose  that  M'  =  (S',  1C,  n').  For  each  formula  Kip  E  C'i,  there  must  exist  a  state 
sg1  E  JC(so)  such  that  (M/s^1)  |=  -np.  Note  that  if  C\  f  0  then  /C'(s0)  f  0.  Define 
/(s0)  =  {s0}  if  s0  E  JC'(s0),  and  I(s0)  =  0  otherwise.  Let  Si  =  (s^1  :  Kip  E  C/}  U  I(s0). 
Note  that  Si  C  /C'(s0)  =  S[,  so  |*S'1 1  <  \S[\.  If  Kip  E  C2  then  K Kip  E  C\ ,  so  there  must 
exist  a  state  s'f2  E  /C'(s))/)  such  that  (M',s^2)  (=  -up.  Moreover,  since  (M',s0)  (=  Kip,  it 
must  be  the  case  that  s^2  ^  /C'(s0).  Let  S2  =  (s^2  :  Kip  E  C2}.  By  construction,  S2  C  S'2, 
so  5'2|  <  1 5)1,  and  Si  and  S2  are  disjoint.  Moreover,  if  Si  =  0,  then  Ci  =  0,  so  C2  =  0  and 
S2  =  0. 

Let  S  =  { s0 }  U  Si  U  S2.  Define  the  binary  relation  1C  on  S  by  taking  /C(s0)  =  .Sj  and 
IC(t)  =  Si  U  S2  for  t  E  S\  U  S2.  To  show  that  /C  is  well  defined,  we  must  show  that  (a) 


6 


s0  ^  S2  and  (b)  if  s0  G  Si,  then  S2  =  0.  For  (a),  suppose  by  way  of  contradiction  that  s0  G  S2. 
Thus,  there  exists  s  £  Si  such  that  s0  G  lC(s).  By  the  Euclidean  property,  it  follows  that 
s0  G  lC(s0),  a  contradiction  since  S2  is  disjoint  from  /C'(s0).  For  (b),  note  that  if  s0  G  Si,  then 
s0  G  /C'(so).  It  is  easy  to  see  that  if  s,s'  G  lC(s0),  then  lC(s)  =  1C  (s').  For  if  s,s'  G  /C'(so) 
then,  by  the  Euclidean  property,  s'  G  lC(s).  Thus,  if  t  G  K'(s),  another  application  of  the 
Euclidean  property  shows  that  t  G  JC(s').  Hence,  1C  (s')  C  lC(s).  A  symmetric  argument 
gives  equality.  But  now  suppose  that  t  G  S2.  Then,  as  we  have  observed,  there  exists  some 
s  G  Si  such  that  t  G  lC(s)  —  lC(s0).  But  if  s0  G  Si,  then  lC(s)  —  /C'(s0)  =  0.  Thus,  S2  =  0  if 
So  G  Si. 

A  similar  argument  shows  that  /C  is  the  restriction  of  1C  to  S.  For  clearly  S2  is  disjoint  from 
lC(s0),  so  /C(s0)  =  lC(so)  (T  S.  Now  suppose  that  s  G  Si  U  S2.  It  is  easy  to  see  that  there  exists 
some  s'  G  Si  such  that  s  G  1C  (s').  This  is  clear  by  construction  if  s  G  S2.  And  if  s  G  Si,  then 
s  G  /C'(s0)  and,  by  the  Euclidean  property,  s  G  /C'(s).  If  t  G  Si  U  S2,  we  want  to  show  that 
t  G  /C'(s).  Again,  there  exists  some  t!  such  that  t'  G  Si  and  t  G  /C'(f').  Since  s',t'  G  /C'(s0), 
by  the  Euclidean  property,  s'  G  /C'(f').  Since  s',t  G  fC(t'),  the  Euclidean  property  implies 
that  t  G  1C  (s').  Since  s,t  G  1C  (s'),  yet  another  application  of  the  Euclidean  property  shows 
that  t  G  /C'(s).  Thus,  /C(s)  C  /C'(s)  (T  S.  To  prove  equality  suppose  that  t  G  /C'(s)  (T  S.  If 
t  e  Si  U  S2,  then  by  definition  t  G  /C(s).  If  t  =  s0,  then  by  the  Euclidean  property  it  follows 
that  s0  G  /C'(s0),  so  s0  G  S1!  C  /C(s).  Thus,  t  G  /C(s),  as  desired. 

Let  M  =  (S,  /C,  7r),  where  n  is  the  restriction  of  n'  to  {s0}  U  Si  U  S2.  It  is  well  known  [6] 
(and  easy  to  prove  by  induction  on  f)  that  there  are  at  most  \ip\  subformulas  of  +.  Since  Gj  and 
C-2  are  disjoint  sets  of  subformulas  of  if,  all  of  the  form  Kip,  and  at  least  one  subformula  of  f 
is  a  primitive  proposition  (and  thus  not  of  the  form  Kip),  it  must  be  the  case  that  Cj  +  \C2\  < 
\<f  \  —  1,  giving  us  the  desired  bound  on  the  number  of  states. 

We  now  show  that  for  all  states  s  G  S  and  for  all  subformulas  ip  of  f  (including  f  itself), 
(M,  s)  \=  ip  iff  (M',  s)  |=  ip.  The  proof  proceeds  by  induction  on  the  structure  of  f.  The  only 
nontrivial  case  is  when  ip  is  of  the  form  Kip'-  If  (M' .  s)  \=  Kip',  then  (M',  t)  |=  ip'  for  all 
t  G  lC(t).  Since  /C  is  the  restriction  of  1C  to  S,  this  implies  that  (M',  t)  f=  ip'  for  all  t  G  lC(s). 
Thus,  by  the  induction  hypothesis,  (M,  t)  \—  ip'  for  all  t  G  lC(s);  that  is,  (M,  s)  |=  Kip' .  For 
the  converse,  suppose  that  (M',  s)  |=  ->Kip'.  If  it  is  also  the  case  that  (M',  s0)  |=  ~^Kip', 
then  Kip'  G  C\.  By  the  construction  of  M  and  the  induction  hypothesis,  (M,  s^,1)  -up'. 

Thus,  (M,  s)  |=  -1  Kip'.  If  (M' .  so)  |=  Kip',  then  standard  arguments  using  the  fact  that  1C  is 
Euclidean  can  be  used  to  show  (M1,  s0)  (=  -1  KKip'.  Thus,  Kip'  G  C2,  and  (M,  spp )  \=  -op' 
by  the  induction  hypothesis.  Again,  it  follows  that  (M,  s)  \=  -1  Kip'. 

By  construction,  (F,  s)  G  Sirwn,  where  m  =  |  |  and  n  —  S2 \ .  We  have  already  observed 

that  m  +  n  <  \<p\,  |5i|  <  \S[\,  and  (^l  <  Thus,  (■ m,n )  <  (m',n').  It  follows  from 
Theorem  2.6  that  (F,  s)  G  TL  C  SL.  This  completes  the  proof.  I 

The  idea  for  showing  that  the  consistency  problem  for  a  logic  L  that  contains  K5  is  NP- 
complete  is  straightforward.  Given  a  formula  f  that  we  want  to  show  is  consistent  with  L, 
we  simply  guess  a  frame  F  =  (S,  1C),  structure  M  based  on  F,  and  state  s  G  S  such  that 
(F,  s)  G  Sm  n  with  m  +  n  <  \+\,  and  verify  that  (M,  s)  |=  f  and  Sm/n  C  TL.  Verifying  that 
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(M,  s )  |=  (f  is  the  model-checking  problem.  It  is  well  known  that  this  can  be  done  in  time 
polynomial  in  the  number  of  states  of  M,  which  in  this  case  is  linear  in  \<p\.  So  it  remains  to 
show  that,  given  a  logic  L  containing  K5,  checking  whether  Sm_n  C  TL  can  be  done  efficiently. 
This  follows  from  observations  made  by  Nagle  and  Thomason  [12]  showing  that  that,  although 
TL  may  include  Smiy  for  infinitely  many  pairs  {in' .  n'),  TL  has  a  finite  representation  that 
makes  it  easy  to  check  whether  Sm  n  C  TL.4 

Say  that  (m,  n)  is  a  maximal  index  of  TL  if  m  >  1,  Sm/n  C  TL,  and  it  is  not  the  case  that 
Sm',n'  ^  TL  for  some  ( m!,n ')  with  (m,  n)  <  ( m!,n ').  It  is  easy  to  see  that  TL  can  have  at 
most  finitely  many  maximal  indices.  Indeed,  if  (m,  n)  is  a  maximal  index,  then  there  can  be  at 
most  m  +  n  —  1  maximal  indices,  for  if  ( in' ,  n')  is  another  maximal  index,  then  either  m'  <  m 
or  n'  <  n  (for  otherwise  (m,  n)  <  (in',  n'),  contradicting  the  maximality  of  (m,  n)).  Say  that 
m  >  1  is  an  infinitary  first  index  of  TL  if  Sm,n  C  TL  for  all  n  >  —1.  Similarly,  say  that 
n  >  —1  is  an  infinitary  second  index  of  TL  if  Sm.n  C  TL  for  all  m  >  1.  Note  that  it  follows 
from  Theorem  2.6  that  if  (1,  —1)  <  (m,  n)  <  (m1,  n'),  then  if  ml  is  an  infinitary  first  index 
of  TL,  then  so  is  m,  and  if  n!  is  an  infinitary  second  index  of  TL,  then  so  is  n.  Suppose  that 
m*  is  the  largest  infinitary  first  index  of  TL  and  n*  is  the  largest  infinitary  second  index  of  TL, 
where  we  take  m*  —  n*  —  oo  if  all  first  indices  are  infinitary  (or,  equivalently,  if  all  second 
indices  are  infinitary),  we  take  m*  =  —  1  if  no  first  indices  are  infinitary,  and  we  take  n*  =  —2 
if  no  second  indices  are  infinitary.  It  follows  from  all  this  that  TL  can  be  represented  by  the 
tuple  (i,  m*,  n*,  (mj,  nfi), . . . ,  (mfc,  nk )),  where 

•  i  is  1  if  50)o  e  and  0  otherwise; 

•  m*  is  the  largest  infinitary  first  index; 

•  n*  is  the  largest  infinitary  second  index;  and 

•  ((mi,ni),...,  (mk,  nk)  are  the  maximal  indices. 

Given  this  representation  of  TL,  it  is  immediate  that  Srnjl  C  TL  iff  one  of  the  following 
conditions  holds: 

•  (m,  n)  =  (0,  0)  and  i  —  1; 

•  1  <  m  <  m*\ 

•  —  1  <  n  <  n*;  or 

•  (■ m,n )  <  (■ mk,nk ). 

4The  representation  that  we  are  about  to  give  is  similar  in  spirit  to,  although  not  the  same  as,  that  of  Nagle  and 
Thomason.  (We  find  ours  both  easier  to  present  and  easier  to  work  with.) 
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We  can  assume  that  the  algorithm  for  checking  whether  a  formula  is  consistent  with  L  is  “hard¬ 
wired”  with  this  description  of  L.  It  follows  that  only  a  constant  number  of  checks  (independent 
of  p )  are  required  to  see  if  S,n/n  C  7+ 5 

Putting  all  this  together,  we  get  our  main  result. 

Theorem  3.2:  For  all  logics  L  containing  K5,  checking  whether  p  is  consistent  with  L  is  an 
NP-complete  problem. 

We  can  actually  improve  Theorem  3.2  slightly.  In  Theorem  3.2,  the  logic  L  is  viewed  as 
fixed;  the  algorithm  gets  as  input  just  the  formula  p.  We  now  show  that,  given  as  input  a  logic 
L  containing  K5  and  a  formula  p,  it  is  NP-complete  to  decide  if  p  is  sastifiable  in  L.  We 
need  to  be  a  little  careful  here;  the  logic  L  consists  of  an  infinite  number  of  formulas,  so  we 
must  present  it  in  an  appropriate  way.  One  way  to  do  this  is  simply  to  describe  L  as  above,  by  a 
tuple  of  the  form  (i,  (mi,  7+, . . . ,  (rnk,nk)).  With  this  representation,  the  result  clearly 

holds,  since  it  is  easy  to  check,  after  guessing  a  situation  Sm^n  that  satisfies  p,  whether  it  is  in 
L.  We  use  a  slightly  different  representation,  but  one  which  quickly  leads  to  the  same  result. 
As  shown  by  Nagle  and  Thomason  [12],  each  logic  L  containing  K5  is  finitely  axiomatizable; 
thus,  we  describe  L  by  giving  as  input  its  axiomatization.  In  fact,  the  axiomatization,  which 
we  now  describe,  closely  follows  the  finite  representation  of  L  given  above. 

For  m  >  0,  let  am  be  the  formula 

m+1  m+1  m+1 

A  K  p'  =►  V  V  K  +  A/'+ 

i=  1  i=l  j=i-\- 1 

(where  Pi,  ■  ■  ■  ,pm+  i  are  distinct  primitive  propositions).  Note  that  if  m  =  0,  then  the  right- 
hand  side  of  the  implication  in  cr0  is  the  empty  disjunction,  which  we  identify  with  the  formula 
false.  It  easily  follows  that  <t0  is  equivalent  to  K~>p\.  Intuitively,  arn  is  valid  in  situation  ( F.  s) 
if  there  are  at  most  m  states  considered  possible  at  s.  Since  there  are  at  most  m  states,  the 
formulas  pk, ... ,  pm+ i  cannot  all  be  true  at  different  states;  there  must  be  some  state  where  two 
of  these  formulas  are  true.  (It  is  easy  to  see  that  cr0,  i.e.,  K~>pu  is  valid  in  (F.  s )  iff  Kfalse  is 
valid  in  ( F ,  s).) 

Similarly,  for  m  >  0,  let  rm  be  the  formula 

m+1  m+1  m+1  m+1 

A  ^KK^pi  A  A  K-'Pi  V  V  -lKK->{piFpj). 

i=l  i=l  i= 1  j=i+ 1 

It  is  straightforward  to  check  that  r0  is  equivalent  to  K->pi  KK~<p\.  Finally,  we  define  r_i 

to  be  the  formula  Kp  =>  p,  =  true,  and  cr_i  =  r_2  =  false. 

The  following  lemma  is  straightforward  to  check. 

sHere  we  have  implicitly  assumed  that  checking  whether  inequalities  such  as  ( m,n )  <  ( m',n ')  hold  can 
be  done  in  one  time  step.  If  we  assume  instead  that  it  requires  time  logarithmic  in  the  inputs,  then  checking  if 
Sm>n  C  Tl  requires  time  logarithmic  in  m  +  n,  since  we  can  take  all  of  m*,n*,  mi, . . .  mk,ri i, . .  ■  ,nk  to  be 
constants. 
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Lemma  3.3:  Suppose  that  (F,  s)  e  Sm  n  for  some  m,n  with  m  >  1,  n  >  —  1  or  ( m,n )  = 
(0,0): 

(a)  Ifk  >  0,  then  (F,  s )  f=  ak  iff  0  <  m  <  k. 

(b)  Ifk  >  —  1,  then  (F,  s )  |=  rk  iff —  l  <  n  <k. 

It  easily  follows  from  Lemma  3.3  that  if  L  is  characterized  by  the  tuple 

R  =  (0,m*,  n*,  (mi,7ii), . . . ,  (mk,nk)), 
then  L  is  characterized  by  the  axiom 

Fr  =  v  Tn*  V  (crmi  A  Tni )  V  . . .  V  (crmfe  A  rnJ 

(in  addition  to  the  axioms  K  and  5,  and  the  rules  of  inference  MP  and  RN). 

If  L  is  characterized  by  the  tuple  R  =  (1,  m*,n*,  (mi,  ni), . . . ,  (mfe,  nfc)),  then  92#  has  the 
additional  disjunct  a0.6 

Theorem  3.4:  Given  as  input  a  logic  L  containing  K5  (where,  if  L  is  characterized  by  the 
tuple  R,  then  the  input  is  actually  the  formula  ipR)  and  a  formula  tp,  the  problem  of  deciding 
whether  tp  is  consistent  with  L  is  NP-complete. 

Proof:  The  argument  is  essentially  identical  to  that  of  Theorem  3.2.  We  simply  guess  a 
frame  (F,  s)  in  Sm  n  for  some  m,  n  with  m  +  n  <  \p\  and  an  interpretation  n  and  check 
that  (F,  7r,  s)  |=  tp  and  that  (F,  s )  (=  pR.  The  key  point  is  that  checking  whether  (F.  s )  \=  pR 
does  not  require  checking  that  (F,  7r',  s)  \=  pR  for  all  interpretations  7r',  since  the  validity  of 
pR  depends  only  on  m  and  n.  I 


4  Discussion  and  Related  Work 

We  have  shown  that,  in  a  precise  sense,  adding  the  negative  introspection  axiom  pushes  the 
complexity  of  a  logic  between  K  and  S4  down  from  P.S PACE- hard  to  NP-complete.  This 
is  not  the  only  attempt  to  pin  down  the  NP-PSPACE  gap  and  to  understand  the  effect  of  the 
negative  introspection  axiom.  We  discuss  some  of  the  related  work  here. 

A  number  of  results  showing  that  large  classes  of  logics  have  an  NP-complete  satisfiability 
problem  have  been  proved  recently.  For  example,  Litak  and  Wolter  [10]  show  that  the  satisfi¬ 
ability  for  all  finitely  axiomatizatble  tense  logics  of  linear  time  is  NP-complete,  and  Bezhan- 
ishvili  and  Hodkinson  [2]  show  that  every  normal  modal  logic  that  properly  extends  S52  (where 
S52  is  the  modal  logic  that  contains  two  modal  operators  K\  and  K 2,  each  of  which  satisfies  the 

6Because  our  representation  of  L  is  somewhat  different  than  that  of  Nagle  and  Thomason,  our  axiom  is  some¬ 
what  different,  although  similar  in  spirit. 
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axioms  and  rules  of  inference  of  S5  as  well  as  the  axiom  K1K2p  AA  K2K\p)  has  a  satisfiability 
problem  that  is  NP-complete.  Perhaps  the  most  closely  related  result  is  that  of  Hemaspaandra 
[14],  who  showed  that  the  consistency  problem  for  any  normal  logic  containing  S4.3  is  also 
NP-complete.  S4.3  is  the  logic  that  results  from  adding  the  following  axiom,  known  in  the 
literature  as  Dl,  to  S4: 

Dl.  K(Kip  ■0)  V  K(K'iJ)  =>-  tp) 

Dl  is  characterized  by  the  connectedness  property:  it  is  valid  in  a  situation  ((S,  1C),  s)  if  for  all 
si,  s2,  S3  G  S,  if  (si,  s2)  G  1C  and  (si,  s3)  G  1C,  then  either  (s2,  s3)  G  1C  or  (s3,  s2)  e  1C.  Note 
that  connectedness  is  somewhat  weaker  than  the  Euclidean  property;  the  latter  would  require 
that  both  (s2,  s3)  and  (s3,  s2)  be  in  1C. 

As  it  stands,  our  result  is  incomparable  to  Hemspaandra’s.  To  make  the  relationship  clearer, 
we  can  restate  her  result  as  saying  that  the  consistency  property  for  any  normal  logic  that 
contains  K  and  the  axioms  T,  4,  and  Dl  is  NP-complete.  We  do  not  require  either  4  or  T 
for  our  result.  However,  although  the  Euclidean  property  does  not  imply  either  transitivity  or 
reflexivity,  it  does  imply  secondary  reflexivity  and  secondary  transitivity.  That  is,  if  1C  satisfies 
the  Euclidean  property,  then  for  all  states  si,  s2,  s3,  s4,  if  (si,  s2)  G  1C,  then  (s2,  s2)  G  1C  and 
if  (s2,s3)  and  (53,54)  G  1C,  then  (s2,s4)  G  /C;  roughly  speaking,  reflexivity  and  transitivity 
hold  for  all  states  s2  in  the  range  of  1C.  Secondary  reflexivity  and  secondary  transitivity  can  be 
captured  by  the  following  two  axioms: 

r.  ic(Kp  =>  ip) 

4'.  K(Kp  =>•  KKip) 

Both  T'  and  4'  follow  from  5,  and  thus  both  are  sound  in  any  logic  that  extends  K5.  Clearly 
T'  and  4'  also  both  hold  in  any  logic  that  extends  S4.3,  since  S4.3  contains  T,  4,  and  the 
inference  rule  RN.  We  conjecture  that  the  consistency  property  for  every  logic  that  extends 
K  and  includes  the  axioms  T',  4',  and  Dl  is  NP-complete.  If  this  result  were  true,  it  would 
generalize  both  our  result  and  Spaan’s  result. 

Vardi  [15]  used  a  difference  approach  to  understand  the  semantics,  rather  than  relational 
semantics.  This  allowed  him  to  consider  logics  that  do  not  satisfy  the  K  axiom.  He  showed 
that  some  of  these  logics  have  a  consistency  problem  that  is  NP-complete  (for  example,  the 
minimal  normal  logic,  which  characterized  by  Prop,  MP,  and  RN),  while  others  are  PSPACE- 
hard.  In  particular,  he  showed  that  adding  the  axiom  Kp  A  AT/;  =>  K(yp  A  A)  (which  is 
valid  in  K)  to  Prop,  MP,  and  RN  gives  a  logic  that  is  PSPACE-hard.  He  then  conjectured 
that  this  ability  to  “combine”  information  is  what  leads  to  PSPACE-hardness.  However,  this 
conjecture  has  been  shown  to  be  false.  There  are  logics  that  lack  this  axiom  and,  nevertheless, 
the  consistency  problem  for  these  logics  is  PSPACE-complete  (see  [1]  for  a  recent  discussion 
and  pointers  to  the  relevant  literature). 

All  the  results  for  this  paper  are  for  single-agent  logics.  Halpern  and  Moses  [7]  showed 
that  the  consistency  problem  for  a  logic  with  two  modal  operators  K\  and  K2,  each  of  which 
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satisfies  the  S5  axioms,  is  PS  PA  CE-  complete.  Indeed,  it  is  easy  to  see  that  if  K,  satisfies  the 
axioms  of  L,  for  some  normal  modal  logic  L,  containing  K5,  then  the  consistency  problem  for 
the  logic  that  includes  K\  and  K2  must  be  PS  PACE- hard.  This  actually  follows  immediately 
from  Ladner’s  [9]  result;  then  it  is  easy  to  see  that  K\K2,  viewed  as  a  single  operator,  satisfies 
the  axioms  of  K.  We  conjecture  that  this  result  continues  to  hold  even  for  non-normal  logics. 

We  have  shown  that  somewhat  similar  results  hold  when  we  add  awareness  to  the  logic  (in 
the  spirit  of  Fagin  and  Halpern  [5]),  but  allow  awareness  of  unawareness  [8].  In  the  single¬ 
agent  case,  if  the  K  operator  satisfies  the  axioms  K,  5,  and  some  (possibly  empty)  subset  of 
{T,  4},  then  the  validity  problem  for  the  logic  is  decidable;  on  other  hand,  if  K  does  not  satisfy 
5,  then  the  validity  problem  for  the  logic  is  undecidable.  With  at  least  two  agents,  the  validity 
problem  is  undecidable  no  matter  which  subset  of  axioms  K  satisfies.  We  conjecture  that, 
more  generally,  if  the  K  operator  satisfies  the  axioms  of  any  logic  L  containing  K5,  the  logic 
of  awareness  of  unawareness  is  decidable,  while  if  K  satisfies  the  axioms  of  any  logic  between 
K  and  S4,  the  logic  is  undecidable. 

All  these  results  strongly  suggest  that  there  is  something  about  the  Euclidean  property  (or, 
equivalently,  the  negative  introspection  axiom)  that  simplifies  things.  However,  they  do  not 
quite  make  precise  exactly  what  that  something  is.  More  generally,  it  may  be  worth  under¬ 
standing  more  deeply  what  is  about  properties  of  the  /C  relation  that  makes  things  easy  or  hard. 
We  leave  this  problem  for  future  work. 
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